What happened
On October 15, 2025, a missing authorization check in Typus Finance's oracle exposed its Sui perpetuals liquidity pool, TLP. The October 16 post-mortem estimated $3.44 million lost; a November update reported $3.26 million. Typus said its SAFU and DeFi Options Vaults were unaffected and published a compensation plan for TLP users.
Technical root cause
The oracle module lacked an authorization assertion. Typus reported that this module was outside its May 2025 MoveBit audit scope and that monitoring was not configured for immediate alerts for this event type.
How it happened
- The oracle's
update_v2function accepted calls without enforcing the intended authorization check. - The attacker supplied false prices and drained TLP assets.
- Typus received an alert at 13:24 UTC and paused its contracts at 13:39.
- The team later returned collateral for paused trading positions and announced a plan to compensate affected liquidity providers.
Protocol details
Classification
Protocol Logic / Oracle Manipulation
Protocol Type
Derivatives
Implementation language
Move
Protocol links
Website
@TypusFinance
Evidence
- report @TypusFinance incident report x.com
- report @TypusFinance incident report x.com
- report Post-mortem medium.com
- report Typus Finance TLP Oracle Exploit: Post-Mortem Report & Response Plan a.foresightnews.pro
- report Typus Oct Update: Navigating a Critical Incident with a Definitive Recovery Plan medium.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
